Narrow basis angle doubles secret key in the 

BB84 protocol 

Ryutaroh Matsumoto 
Department of Communications and Integrated Systems 
Tokyo Institute of Technology, 152-8550 Japan 
Email: ryutaroh@rmatsumoto.org 
and 

Shun Watanabe 
Department of Information Science and Intelligent Systems 
Tokushima University, 770-8506 Japan 
Email : shun- wata @ is . tokushima-u. ac .jp 

June 2009 

Abstract 

We consider a modified version of the BB84 quantum key distribution pro- 
tocol in which the angle between two different bases are less than n/A. We 
show that the channel parameter estimate becomes the same as the origi- 
nal protocol with sufficiently many transmitted qubits. On the other hand, 
the statistical correlation between bits transmitted in one basis and those re- 
ceived in the other basis becomes stronger as the angle between two bases 
becomes narrower. If the angle is very small, the statistical correlation be- 
tween bits transmitted in one basis and those received in the other basis is 
as strong as those received in the same basis as transmitting basis, which 
means that the modified protocol can generate almost twice as long secret 
key as the original protocol, provided that Alice and Bob choose two dif- 
ferent bases with almost the same probability. We also point out that the 
reverse reconciliation often gives different amount of secret key to the direct 
reconciliation over Pauli channels with our modified protocol. 
PACS number: 03.67.Dd 
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1 Introduction 



The Bennett-Brassard 1984 protocol (BB84 protocol) [2J is one of the most- 
known protocols for quantum key distribution (QKD). In this protocol, the sender, 
Alice, sends qubits in one of four quantum states, represented by quantum state 
vectors |0), |1), |+) = (|0) + |l))/v^, |-) = (-|0) + |l))/v^, where {|0), |1)} 
forms an orthonormal basis. Then the receiver. Bob, measures them with either 
{|0), |1)} or {|+), | — )} basis. After that, Alice publicly announces to which 
{|0), |1)} or {|+), |— )} basis each qubit belongs. Bob discard the measurement 
outcomes whose bases do not contain the transmitted states. We call such mea- 
surement mismatched measurement in this paper. After that, Alice and Bob per- 
form the information reconciliation and the privacy amplification to obtain the 
same secret key as described in Ref. [15]. In this standard protocol, we have 
\+) = cos0|O) + sin0|l) and |-) = -sin0|O) +cos0|l) with = n/A. In this 
paper we shall call 9 as the angle between two bases. 

As far as the authors know, there is no literature that shows a merit of using 
smaller values of in the BB84 protocol, while Tamaki et al. [T6] quantitatively 
demonstrated the merit of adjusting the angle between two different quantum 
states in the Bennett 1992 (B92) protocol [IJ. A possible reason for the absence 
of consideration of narrower angle d < ;r/4 is that the narrower angle makes it 
difficult to obtain a meaningful lower bound on the amount of secret key by the 
conventional channel parameter estimation as described in Section |Z2| This dif- 
ficulty leads us to use the accurate channel parameter estimation method [17] for 
the BB84 protocol with narrower angle. We shall show that over any quantum 
channel between Alice and Bob, including Pauli channels, we can obtain almost 
the same amount of secret key from mismatched measurement outcomes when the 
angle between two bases is sufficiently narrow, while obtaining asymptotically the 
same amount of key per transmitted qubit from matched measurement outcomes, 
by using the accurate estimation method. We note that we already considered to 
obtain secret key from mismatched measurement outcomes in Ref. [[m . However 
Ref. [[m was not so useful because we cannot obtain secret key if the channel is 
a Pauli one. 

On the other hand, the amount of secret key is the same in the direct and 
reverse reconciliations in the standard BB84 protocol over Pauli channels [iTSll . 
even if we use the accurate channel parameter estimation [17|. In contrast to 
this, we also point out that the reverse reconciliation [|4l[T2l often gives different 
amount of secret key to the direct reconciliation over Pauli channels with our 
modified protocol. 
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This paper is organized as follows: Section [21 presents a modified version of 
the BB84 protocol, its security, and its performance analysis. Section [3] gives 
concluding remarks. 

2 Protocol 

2.1 Outline of the protocol 

In this section, we shall show a variant of the BB84 protocol that tries to extract 
secret key from mismatched measurement outcomes. Section lZTI describes an out- 
line of the protocol. Section [Z2l derives the amount of secret key, and Section [23] 
considers the reverse reconciliation. We define the matrices X and Z representing 
the bit error and the phase error, respectively, as 

X|0) = |1), X|1) = |0), 
Z|+) = |-), z\-) = \+), 

and Y = iXZ. We also fix < < :7r/4 and define 

l+e) = cos0|O)+sin0|l), 
|-e) = -sin0|O)+cos0|l). 

1 . Alice makes a random qubit sequence according to the i.i.d. uniform distri- 
bution on {|0), 1 1), l+e)^ |~e)} and sends it to Bob. 

2. Bob chooses the { 1 0), |1)} basis or (l+e), l — g)} basis uniformly randomly 
for each received qubit and measures it by the chosen basis. 

3. Alice publicly announces which basis { 1 0), |l)}or{|+e), I—q)} each trans- 
mitted qubit belongs to. Bob also publicly announces which basis was used 
for measurement of each qubit. 

4. Suppose that there are 2n qubits transmitted in the { |0) , 1 1 ) } basis and mea- 
sured with the |— e)} basis by Bob. Index those qubits by 1, . . . , 
2n. Define the bit Xj = if Alice's z-th qubit was |0), and = 1 otherwise. 
Define the bity, = if Bob's measurement outcome for z-th qubit was |+e), 
and yi = 1 otherwise. 
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5. Suppose also that there are 2n' qubits transmitted in the {|0), 1 1)} basis and 
measured with the {|0), |1)} basis by Bob. Index those qubits by 1, . . . , 
2n'. Define the bit at = if Alice's i-th qubit was |0), and a, = 1 otherwise. 
Define the bit bi = if Bob's measurement outcome for z-th qubit was |0), 
and bi = 1 otherwise. 

6. Suppose also that there are 2n" qubits transmitted in the {|+e)' |~e)} basis 
and measured with the |— e)} basis by Bob. Index those qubits by 
1, . . . , 2n". Define the bit a, = if Alice's i-th qubit was and a, = 1 
otherwise. Define the bit j8,' = if Bob's measurement outcome for i-th 
qubit was \+e), and /3/ = 1 otherwise. 

7. For each combination of the transmission and the reception bases, Alice and 
Bob publicly announce the half of transmitted qubits and measurement out- 
comes. They conduct the channel parameter estimation described in Section 
O We also define 

|{/e5|.^,^3;,}| \{iES'\ai^bi}\ 
qi = ^ , q2 = , 

where S and S' are the set of indices that are announced for channel param- 
eter estimation. 

8. Alice and Bob decide^ a linear code Ci of length n such that its decoding 
error probability is sufficiently small over all the binary symmetric channel 
whose crossover probability is close to qi. Let Hi be a parity check matrix 
for Ci, X be Alice's remaining (not announced) bits among x/s, and y be 
Bob's remaining bits among j/'s. 

9. Alice publicly announces the syndrome H\x. 

10. Bob computes the error vector e such i\\dX Hie = Hiy — H\xhy the decoding 
algorithm for Ci . With high probability 3^— e = x. 

11. Alice chooses a subspace C2 C Ci with dimC2 = n{l — S{X\E) + g) uni- 
formly randomly, where e > and S{X\E) denotes the conditional von Neu- 
mann entropy of Alice's bit Xi given the quantum state of the environment 
E as defined in Refs. |fT3l [T4l . which can be regarded as the eavesdropper 
Eve's ambiguity on Alice's bit x,. After that she publicly announces her 
choice of C2. The final shared secret key is the coset x-\-C2- 

'One can also use the Slepian-Wolf code used in Ref. ifTTl . 
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Provided that e > 0, the privacy amplification theorem with quantum eavesdrop- 
per's memory [fT3l [T4l guarantees that that the final key X + becomes secure 
in the sense of Refs. lfT3l [T4l as n — > 00, which roughly means that the final key 
and the quantum state of the environment become statistically independent and 
that the final key has an almost uniform distribution on the set C1/C2. We shall 
consider the amount of secret key obtained by the above protocol in Section [Z2l 

2.2 Amount of secret key 

We shall use the accurate channel parameter estimation [fTTl. which gives asymp- 
totically more secret key than the conventional estimation. This procedure is as 
follows: We do not make any assumption on the quantum channel between Al- 
ice and Bob, so the channel is specified by 12 real parameters. For 16 pairs 
|v)) G {|0), |1), l+e), | — e)}^, we record the 16 relative frequencies of the events 
in which \u) is transmitted and |v) is observed as the measurement outcome, which 
enable us to estimate 6 out of 12 channel parameters. After estimating the part of 
parameters, we use the minimum of S{X\E) over all the possible quantum chan- 
nels, that is, we use the worst case estimate of S{X\E) of quantum channels giv- 
ing the 16 recorded relative frequencies, as done in the conventional estimation 
[EB im [HI. The set of estimatable parameters with < < ;r/4 is the same as 
9 = Tz/A. The reason is as follows: Since the linear space spanned by {|0)(0|, 
|— el} is the same for all < < k/A and the expecta- 
tion of the relative frequency of sending \u) and observing |v) is proportional to 
Tr[A(|a)(M|)|v)(v|] for any quantum channel A, there always exists a one-to-one 
linear relation that translates the set of 16 relative frequencies with Q <%/Aio that 
with = k/A. Therefore, the estimate of the worst case S{X\E) does not depend 
on the value of Q. This means that the amount of secret key from matched mea- 
surement outcomes remains asymptotically the same even if we use Q narrower 
than k/A. 

We cannot use a straightforward generalization of the conventional channel 
parameter estimation, that is to record two relative frequencies of the event (a) in 
which |0) is sent and |1) is observed or |1) is sent and |0) is observed, and the 
event (b) in which is sent and |— g) is observed or |— 0) is sent and \+e) 
is observed. The reason of unavailability of the conventional channel parameter 
estimation is as follows: We cannot estimate the parameters of the Pauli channel 
that is obtained as the partial twirling [[3l of the actual quantum channel, because 

^See also Eq. (12) of Ref. ISj, in which the partial twirling is called the discrete twirhng. 
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the relative frequency of the event (b) also dependqj on the non-diagonal elements 
in the Choi matrix [|6J of the actual quantum channel with respect to the Bell basis 
as well as the diagonal elements unless 9 = Tz/A, and the 4 diagonal elements in 
the Choi matrix specify the Pauli channel obtained by the partial twirling. Since 
the standard technique is to bound the required dimension of C2 in Step [TT] over 
the actual channel from above by the required dimC2 over its partially twirled 
channel, the inability to estimate the partially twirled channel prevents us from 
obtaining a useful upper bound on dimC2 of the actual channel. Thus, it is difficult 
to ensure that the worst case estimate of dimC2 is independent of 9 by the above 
generalization of the conventional channel parameter estimation, and we have to 
use the 16 relative frequencies to bound dimC2 from above. Note that Tamaki 
et al. IIT6II already observed similar dependence of the worst case estimate on the 
angle between two quantum states in the B92 protocol |[T1. 
The amount of secret key is lfT3l [T4l 

S{X\E)-h{qi) 

from single bit xt not announced for channel parameter estimation, while this 
amount is 

S{X\E)-h{q2) (1) 

from a,, where h{) denotes the binary entropy function. Since q\ q2 d& 9 ^ 
and h{) is a continuous function, we conclude that we can obtain almost the same 
amount of secret key from as a,. 

2.3 Reverse reconciliation 

The reverse reconciliation pl [121 is the method of reconciliation in which Bob 
publicly announces the syndrome H\y in Step [9] instead of Alice, Alice computes 
y in Step [10] instead of Bob, and the final key is generated from y. The standard 
way of reconciliation [[TSl is called the direct reconciliation. In order to give a 
simpler exposition of the main contribution, we have restricted ourselves to the 
direct reconciliation up to this point. In this subsection we shall consider the 
reverse reconciliation and point out that the amount of secret key is often different 
in the reverse reconciliation to the direct one over a Pauli channel. 

We can also use the same parity check matrix H\ in Step [8] since x can be 
regarded as the output of the binary symmetric channel with crossover probability 

^The relative frequency of the event (a) is independent of the non-diagonal elements in the 
Choi matrix. 
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q\ with input y. We have to change dimC2 in Step[TT]to dimC2 = n(l — S{Y\E) + 
e), where S{Y\E) denotes the conditional von Neumann entropy of Bob's bit ji 
given the quantum state of the environment E. We have to compute the minimum 
value of S{Y\E) over quantum channels that give the recorded relative frequencies. 

Hereafter we assume that the channel between Alice and Bob is a Pauli chan- 
nel that sends a qubit density matrix p to 



instead of a general qubit channel that is not necessarily a Pauli one. We define 



It is well-known that the worst case 5(X|£) is 1 - h{pz) ITTI [T3l . 

In the evaluation of the worst case S{Y\E), Bob's bit Y can be regarded as the 
measurement outcome in the {|0), 1 1)} basis on the output of the unitary channel 
rotating \-\-e) to |0) and |— e) to |1), connected to the actual channel. The Pauli 
channel followed by a rotation is a unital channel, which outputs the completely 
mixed state if the input is completely mixed. This observation enables us to apply 
the formula for the worst case S{Y\E) over unital channels given in Proposition 2 
and Remark 6 of Ref. [fTTll . which gives 



We can see that S{Y\E) \-h{pz) as ^ and S{Y\E) \-h{px) as ^ 
Tz/A, which confirm our intuition. Observe also that generally S{X\E) ^ S{Y\E) 
when px^pz- 

By using a similar idea, we can obtain Eve's ambiguity on Alice's bit a, that 
is transmitted in the {|+e), |— e)} basis. By the continuity of the von Neumann 
entropy, we can also see that the amount of secret key from a,- converges to Eq. 
(dl) obtained from at as n ^ oo and 9^0. Therefore, the conclusion in Section 
12.21 also holds for qubits transmitted by the \—q)} basis. 

3 Concluding remarks 

We have shown that from mismatched measurement outcomes we can obtain as 
much secret key per transmitted qubit as matched measurement outcomes over any 



r(p) = {l-rx-rY-rz)p + rxXpX + vyYpY + rzZpZ, 



Px = rx + rY: Pz = rz + rY. 



S{Y\E) = l-h{px)-h{pz)+h 




) 
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channels if we make the angle between two bases sufficiently narrow. The same 
conclusion holds for the six-state protocol [|5| and the variants of the standard 
BB84 protocols with the noisy preprocessing lfT3l[T4ll . and the advantage distilla- 
tion [7lfT8T|. We have also pointed out that the reverse reconciliation often gives 
different amount of secret key to the direct reconciliation over Pauli channels with 
our modified protocol, which is contrasting to the standard BB84 protocol [fT5l . 
and that there is difficulty to use the conventional channel parameter estimation if 
the angle between two bases is narrower than k/A. 

The advantage of the proposed protocol is that we can obtain 1 — h{px) — 
h{pz) bits of secret key per single qubit that is not used for channel parameter 
estimation. The same advantage is also realized when we decrease the ratio of 
the number of transmitted qubits in the {|+), |— )} basis to that in the {|0), |1)} 
basis flU [TOl. Although the proposed method, the method in Refs. [|9l [TOl, and 
their combination have exactly the same performance in the asymptotic limit of 
infinitely many qubits, they may have different performances in the finite number 
of qubits. The identification of the best method among these three methods in the 
finite setting is a future research agenda. This identification might be analytically 
difficult as stated in the introduction of Ref. [9J. 
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